UCF STIG Viewer Logo

The kernel core dump data directory must be owned by root.


Overview

Finding ID Version Rule ID IA Controls Severity
V-11997 GEN003520 SV-37570r2_rule Low
Description
Kernel core dumps may contain the full contents of system memory at the time of the crash. As the system memory may contain sensitive information, it must be protected accordingly. If the kernel core dump data directory is not owned by root, the core dumps contained in the directory may be subject to unauthorized access.
STIG Date
Red Hat Enterprise Linux 5 Security Technical Implementation Guide 2017-03-01

Details

Check Text ( C-36351r2_chk )
Verify the location of the kernel core dump data directory:
# grep “path” /etc/kdump.conf

Note: If this setting is not configured or commented out, the default kernel dump data directory is /var/crash.

Check the ownership of the dump data directory:
# ls –ld

If the kernel core dump data directory is not owned by root, this is a finding.
Fix Text (F-31608r3_fix)
Change the owner of the kernel core dump data directory to root.
# chown root